T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_digest.py:17- Finding
Untrusted Input Is Written to Markdown Without Context-Aware Escaping
- Content
View full analysis
- Remediation
View remediation
Security audit
X Builder Digest
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed digest generator that reads user-provided JSON and writes English and Chinese Markdown files, with a publication-safety caveat for unescaped input content.
Reasonable to install for local digest generation. Use curated or trusted input where possible, and before publishing the generated Markdown, sanitize it or render it with raw HTML and unsafe URL schemes disabled, because feed content can be copied into the output as Markdown/HTML-like text.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The core purpose mostly aligns: the script converts JSON social/podcast/blog data into English and Chinese markdown digests and preserves links. However, there are material gaps versus the declared description. Most notably, there is no support for an optional compressed executive-style output. Also, the bilingual digest behavior is asymmetric: English includes shortened tweet text, while Chinese does not transform tweet content into concise summaries except for a few hardcoded names; otherwise it emits a generic message telling readers to check the original. The claimed 'first-mention person blurbs' are only implemented as a static lookup for three names, not as a general first-mention enrichment mechanism. These are sufficient to mark the description as not fully accurate.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title explicitly labels the content as a Chinese version, indicating a fixed language/locale choice. Under the policy, forcing a specific language is a violation unless the skill offers user choice or clearly documents a justified region-specific constraint, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code always writes both an English digest and a Chinese digest, including a Chinese-titled file and Chinese-language summaries, regardless of user preference. The policy explicitly flags language or locale constraints when the skill forces a specific language without offering a choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title explicitly labels the file as a Chinese version, and all content is presented only in Chinese. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy issue.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest description emphasizes turning social feed JSON into bilingual digest output, which reads primarily like a transformation task. In implementation, the script also creates an output directory and writes two markdown files, adding filesystem side effects beyond pure rendering.
- Content
Static analysis
No suspicious patterns detected.